PKINIT responder fixups

Greg noted that the PKINIT client module produces empty JSON objects when it doesn't require any input, and we need to fix that.  This series corrects that, teaches the responder test helper to explicitly check for "there's no challenge for that question", and adjusts tests to use the helper to check for the no-challenge case in the right places.